[Bug binutils/30890] New: objdump: attempting free on address which was not malloc()-ed at bfd/elf.c:9802 in _bfd_elf_slurp_version_tables

[yan.cs10 at nycu dot edu.tw]

https://sourceware.org/bugzilla/show_bug.cgi?id=30890

            Bug ID: 30890
           Summary: objdump: attempting free on address which was not
                    malloc()-ed at bfd/elf.c:9802 in
                    _bfd_elf_slurp_version_tables
           Product: binutils
           Version: 2.42 (HEAD)
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: binutils
          Assignee: unassigned at sourceware dot org
          Reporter: yan.cs10 at nycu dot edu.tw
  Target Milestone: ---

Created attachment 15129
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15129&action=edit
this poc with -T argument can crash objdump in the latest version

Summary:

A crash caused when using objdump
AddressSanitizer reported it as attempting free on address which was not
malloc()-ed

git commit, OS, Compiler and processor

git commit: be8e83130
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
g++ (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0
Ubuntu 20.04.4 LTS
AMD Ryzen 5 3600X 6-Core Processor

Steps to reproduce:

$ cd binutils-gdb
$ export CFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ export CXXFLAGS='-fsanitize=address -fsanitize-recover=address -g3'
$ make
$ binutils/nm-new -D ./poc_0

AddressSanitizer report:

$ /home/pt/sytseng/binutils-gdb-asan/binutils/objdump -T ./poc_0

/home/pt/sytseng/binutils-gdb-asan/binutils/objdump: option -P/--private not
supported by this file
BFD: ./pocs/poc_0: .gnu.version_r invalid entry
=================================================================
==2486577==ERROR: AddressSanitizer: attempting free on address which was not
malloc()-ed: 0x621000006688 in thread T0
    #0 0x7f62bd29140f in __interceptor_free
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
    #1 0x55892d993c66 in _bfd_elf_slurp_version_tables
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9802
    #2 0x55892d948805 in bfd_elf64_slurp_symbol_table
/home/pt/sytseng/binutils-gdb-asan/bfd/elfcode.h:1278
    #3 0x55892d99022d in _bfd_elf_canonicalize_dynamic_symtab
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:9285
    #4 0x55892d77be96 in slurp_dynamic_symtab objdump.c:1051
    #5 0x55892d7923e0 in dump_bfd objdump.c:5656
    #6 0x55892d7928cd in display_object_bfd objdump.c:5750
    #7 0x55892d792c05 in display_any_bfd objdump.c:5837
    #8 0x55892d792c7f in display_file objdump.c:5858
    #9 0x55892d794633 in main objdump.c:6269
    #10 0x7f62bcfb0082 in __libc_start_main ../csu/libc-start.c:308
    #11 0x55892d77837d in _start
(/home/pt/sytseng/binutils-gdb-asan/binutils/objdump+0x13737d)

0x621000006688 is located 392 bytes inside of 4064-byte region
[0x621000006500,0x6210000074e0)
allocated by thread T0 here:
    #0 0x7f62bd291808 in __interceptor_malloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
    #1 0x55892db79bf2 in _objalloc_alloc objalloc.c:159
    #2 0x55892d8d560c in bfd_alloc
/home/pt/sytseng/binutils-gdb-asan/bfd/libbfd.c:452
    #3 0x55892d95fa52 in _bfd_elf_get_dynamic_symbols
/home/pt/sytseng/binutils-gdb-asan/bfd/elf.c:2293
    #4 0x55892d9457a5 in bfd_elf64_object_p
/home/pt/sytseng/binutils-gdb-asan/bfd/elfcode.h:861
    #5 0x55892d8d11fe in bfd_check_format_matches
/home/pt/sytseng/binutils-gdb-asan/bfd/format.c:431
    #6 0x55892d7928b5 in display_object_bfd objdump.c:5748
    #7 0x55892d792c05 in display_any_bfd objdump.c:5837
    #8 0x55892d792c7f in display_file objdump.c:5858
    #9 0x55892d794633 in main objdump.c:6269
    #10 0x7f62bcfb0082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: bad-free
../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122 in
__interceptor_free
==2486577==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.